Quote from: Riva59 on September 11, 2014, 09:57:48 PM

I just set up username/password and 2FA and was able to:

logout
loging in through my secret login link
devest BTC
placing a bet

without giving another authentication then the initial secret login link.

Quote from: dooglus on September 25, 2014, 05:38:04 AM

I was unable to access my account for a few hours this afternoon.

I finally figured out that by clicking 'logout' and then logging back in, it worked.

In the process of figuring that out, I discovered that even though I have set up a username and password on my account, the old "secret URL" still works. So anyone who finds my secret URL can get into my account even if they don't know my password. They can also then divest and gamble away my coins, since 2FA is only required when ~~divesting~~ withdrawing.

I'd like it if:

1) setting a username and password stopped the secret URL from working
2) 2FA could be independently enabled for login, play, divest, and withdraw (rather than only being required for withdraw as it currently is)

Edit: fixed; thanks DiamondCardz!

Nope, sorry the fix does seam to work. I'm still able to login through secret URL after logging out.